@elisym/sdk 0.22.0 → 0.24.0

package/dist/index.js

@@ -68,10 +68,35 @@ var DEFAULTS = {
   RESULT_RETRY_COUNT: 3,
   RESULT_RETRY_BASE_MS: 1e3,
   QUERY_MAX_CONCURRENCY: 6,
-  VERIFY_SIGNATURE_LIMIT: 25
+  VERIFY_SIGNATURE_LIMIT: 25,
+  // Default ceiling for a single iroh file transfer (seed/fetch). A tunable
+  // default, not a protocol constant - the transfer is resumable and its own
+  // budget, decoupled from the result-wait window.
+  IROH_FETCH_TIMEOUT_MS: 3e5
 };
 var LIMITS = {
   MAX_INPUT_LENGTH: 1e5,
+  // NIP-44 v2 hard cap on encrypted plaintext: the pad() length prefix is a u16,
+  // so the plaintext can be at most 65_535 BYTES (not chars). Encrypting anything
+  // larger throws `invalid plaintext size` inside nip44Encrypt. This is the binding
+  // limit for TARGETED (encrypted) jobs - lower than every relay's NIP-11 cap.
+  NIP44_MAX_PLAINTEXT_BYTES: 65535,
+  // Spill threshold for encrypted content: above this many UTF-8 bytes, callers
+  // route the text through iroh out-of-band instead of inlining it. A non-spilled
+  // job is encrypted RAW (no envelope - see marketplace.submitJobRequest), so a
+  // 60_000-byte input is a 60_000-byte plaintext; the ~5.5KB gap under the hard cap
+  // is plain slack, and NIP44_MAX_PLAINTEXT_BYTES is the SDK backstop.
+  MAX_ENCRYPTED_INLINE_BYTES: 6e4,
+  // Ceiling above which a text/* attachment is NOT materialized back into a string
+  // (re-inlined into SkillInput.data) - the consumer gets a filePath / explicit
+  // fetch instead. Also bounds the in-memory git-diff buffer (memory-DoS guard).
+  MAX_REINLINE_TEXT_BYTES: 4194304,
+  // 4 MiB
+  // Hard safety cap on a single file transferred via iroh, enforced on the
+  // actual streamed bytes (never the sender-declared `size`). A tunable default;
+  // providers may lower it per deployment.
+  MAX_FILE_SIZE: 1073741824,
+  // 1 GiB
   MAX_TIMEOUT_SECS: 600,
   // Upper bound for execution budgets (`max_execution_secs` / `execution_timeout_secs`).
   // Distinct from MAX_TIMEOUT_SECS (the result-wait cap): execution budgets may be
@@ -89,6 +114,10 @@ var LIMITS = {
   MAX_POLICY_SUMMARY_LENGTH: 280,
   MAX_POLICY_VERSION_LENGTH: 32
 };
+var UTF8_ENCODER = new TextEncoder();
+function utf8ByteLength(value) {
+  return UTF8_ENCODER.encode(value).length;
+}
 function getConfigDecoder() {
   return getStructDecoder([
     ["discriminator", fixDecoderSize(getBytesDecoder(), 8)],
@@ -1212,6 +1241,12 @@ function parseCapabilityEvent(event, network) {
   if (card.payment && (typeof card.payment.chain !== "string" || typeof card.payment.network !== "string" || typeof card.payment.address !== "string")) {
     return null;
   }
+  if (card.payment && (card.payment.token !== void 0 && typeof card.payment.token !== "string" || card.payment.symbol !== void 0 && typeof card.payment.symbol !== "string" || card.payment.mint !== void 0 && typeof card.payment.mint !== "string")) {
+    return null;
+  }
+  if (card.inputMime !== void 0 && (typeof card.inputMime !== "string" || card.inputMime.length > 255) || card.outputMime !== void 0 && (typeof card.outputMime !== "string" || card.outputMime.length > 255)) {
+    return null;
+  }
   if (card.payment?.job_price !== null && card.payment?.job_price !== void 0 && (!Number.isInteger(card.payment.job_price) || card.payment.job_price < 0)) {
     return null;
   }
@@ -1472,6 +1507,7 @@ var DiscoveryService = class {
       return agents;
     }
     const deliveredJobsByProvider = /* @__PURE__ */ new Map();
+    const customerByJob = /* @__PURE__ */ new Map();
     for (const ev of resultEvents) {
       if (!verifyEvent(ev)) {
         continue;
@@ -1491,8 +1527,13 @@ var DiscoveryService = class {
           deliveredJobsByProvider.set(ev.pubkey, delivered);
         }
         delivered.add(jobEventId);
+        const customerPubkey = ev.tags.find((tag) => tag[0] === "p")?.[1];
+        if (customerPubkey) {
+          customerByJob.set(jobEventId, customerPubkey);
+        }
       }
     }
+    const countedRatings = /* @__PURE__ */ new Set();
     for (const ev of feedbackEvents) {
       if (!verifyEvent(ev)) {
         continue;
@@ -1508,19 +1549,25 @@ var DiscoveryService = class {
       if (ev.created_at > agent.lastSeen) {
         agent.lastSeen = ev.created_at;
       }
+      const jobEventId = ev.tags.find((tag) => tag[0] === "e")?.[1];
+      const hasDeliveredResult = jobEventId !== void 0 && deliveredJobsByProvider.get(targetPubkey)?.has(jobEventId) === true;
+      const jobCustomer = jobEventId !== void 0 ? customerByJob.get(jobEventId) : void 0;
+      const authoredByCustomer = jobCustomer !== void 0 && ev.pubkey === jobCustomer;
       const rating = ev.tags.find((tag) => tag[0] === "rating")?.[1];
-      if (rating === "1" || rating === "0") {
-        agent.totalRatingCount = (agent.totalRatingCount ?? 0) + 1;
-        if (rating === "1") {
-          agent.positiveCount = (agent.positiveCount ?? 0) + 1;
+      if ((rating === "1" || rating === "0") && hasDeliveredResult && authoredByCustomer) {
+        const ratingKey = `${ev.pubkey}:${jobEventId}`;
+        if (!countedRatings.has(ratingKey)) {
+          countedRatings.add(ratingKey);
+          agent.totalRatingCount = (agent.totalRatingCount ?? 0) + 1;
+          if (rating === "1") {
+            agent.positiveCount = (agent.positiveCount ?? 0) + 1;
+          }
         }
       }
       const status = ev.tags.find((tag) => tag[0] === "status")?.[1];
       const txTag = ev.tags.find((tag) => tag[0] === "tx");
       const txSignature = txTag?.[1];
-      const jobEventId = ev.tags.find((tag) => tag[0] === "e")?.[1];
-      const hasDeliveredResult = jobEventId !== void 0 && deliveredJobsByProvider.get(targetPubkey)?.has(jobEventId) === true;
-      if (status === "payment-completed" && typeof txSignature === "string" && txSignature && hasDeliveredResult) {
+      if (status === "payment-completed" && typeof txSignature === "string" && txSignature && hasDeliveredResult && authoredByCustomer) {
         if (!agent.lastPaidJobAt || ev.created_at > agent.lastPaidJobAt) {
           agent.lastPaidJobAt = ev.created_at;
           agent.lastPaidJobTx = txSignature;
@@ -1776,6 +1823,67 @@ function nip44Decrypt(ciphertext, receiverSk, senderPubkey) {
   const conversationKey = nip44.v2.utils.getConversationKey(receiverSk, senderPubkey);
   return nip44.v2.decrypt(ciphertext, conversationKey);
 }
+var ENVELOPE_VERSION = "elisym-job/1";
+var ENVELOPE_NAMESPACE_PREFIX = "elisym-job/";
+var MAX_TICKET_LENGTH = 4096;
+var FileTransportSchema = z.discriminatedUnion("kind", [
+  z.object({
+    kind: z.literal("iroh"),
+    /** Opaque iroh `BlobTicket` string. Parsed into a real ticket only at fetch time. */
+    ticket: z.string().min(1).max(MAX_TICKET_LENGTH)
+  })
+]);
+var FileAttachmentSchema = z.object({
+  /** Display name only. Never used to derive a filesystem path (callers sanitize). */
+  name: z.string().min(1).max(255),
+  /** Declared size in bytes (display/hint only; enforcement is on actual streamed bytes). */
+  size: z.number().int().nonnegative(),
+  mime: z.string().min(1).max(255),
+  /** Ordered by sender preference; at least one. */
+  transports: z.array(FileTransportSchema).min(1),
+  /** Optional provider hint (unix seconds) for when seeding may stop. */
+  seedingExpiresAt: z.number().int().nonnegative().optional()
+});
+var JobPayloadEnvelopeSchema = z.object({
+  v: z.literal(ENVELOPE_VERSION),
+  text: z.string().optional(),
+  attachment: FileAttachmentSchema.optional()
+});
+function encodeJobPayload(payload) {
+  const envelope = { v: ENVELOPE_VERSION };
+  if (payload.text !== void 0) {
+    envelope.text = payload.text;
+  }
+  if (payload.attachment !== void 0) {
+    envelope.attachment = payload.attachment;
+  }
+  return JSON.stringify(envelope);
+}
+function decodeJobPayload(content) {
+  if (content.length > LIMITS.MAX_INPUT_LENGTH) {
+    return { text: content };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return { text: content };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { text: content };
+  }
+  const version = parsed.v;
+  if (typeof version !== "string" || !version.startsWith(ENVELOPE_NAMESPACE_PREFIX)) {
+    return { text: content };
+  }
+  const result = JobPayloadEnvelopeSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new Error(
+      `Invalid elisym job payload (v=${JSON.stringify(version)}): ${result.error.message}`
+    );
+  }
+  return { text: result.data.text, attachment: result.data.attachment };
+}
 
 // src/services/marketplace.ts
 function isEncrypted(event) {
@@ -1808,7 +1916,8 @@ var MarketplaceService = class {
   }
   /** Submit a job request with NIP-44 encrypted input. Returns the event ID. */
   async submitJobRequest(identity, options) {
-    if (!options.input) {
+    const hasAttachment = options.attachment !== void 0;
+    if (!options.input && !hasAttachment) {
       throw new Error("Job input must not be empty.");
     }
     if (options.input.length > LIMITS.MAX_INPUT_LENGTH) {
@@ -1822,7 +1931,15 @@ var MarketplaceService = class {
     if (options.providerPubkey && !/^[0-9a-f]{64}$/.test(options.providerPubkey)) {
       throw new Error("Invalid provider pubkey: expected 64 hex characters.");
     }
-    const plaintext = options.input;
+    const plaintext = hasAttachment ? encodeJobPayload({ text: options.input || void 0, attachment: options.attachment }) : options.input;
+    if (options.providerPubkey) {
+      const plaintextBytes = utf8ByteLength(plaintext);
+      if (plaintextBytes > LIMITS.NIP44_MAX_PLAINTEXT_BYTES) {
+        throw new Error(
+          `Encrypted job input too large: ${plaintextBytes} bytes (max ${LIMITS.NIP44_MAX_PLAINTEXT_BYTES}). Send large input as a file/iroh attachment instead.`
+        );
+      }
+    }
     const encrypted = options.providerPubkey ? nip44Encrypt(plaintext, identity.secretKey, options.providerPubkey) : plaintext;
     const tags = [
       ["i", options.providerPubkey ? "encrypted" : "text", "text"],
@@ -1916,9 +2033,15 @@ var MarketplaceService = class {
       if (content === null) {
         return;
       }
+      let decoded;
+      try {
+        decoded = decodeJobPayload(content);
+      } catch {
+        return;
+      }
       resultDelivered = true;
       try {
-        cb.onResult?.(content, ev.id);
+        cb.onResult?.(decoded.text ?? "", ev.id, decoded.attachment);
       } catch {
       } finally {
         done();
@@ -2082,8 +2205,9 @@ var MarketplaceService = class {
     );
   }
   /** Submit a job result with NIP-44 encrypted content. Result kind is derived from the request kind. */
-  async submitJobResult(identity, requestEvent, content, amount) {
-    if (!content) {
+  async submitJobResult(identity, requestEvent, content, amount, attachment) {
+    const hasAttachment = attachment !== void 0;
+    if (!content && !hasAttachment) {
       throw new Error("Job result content must not be empty.");
     }
     if (!Number.isInteger(requestEvent.kind)) {
@@ -2096,7 +2220,16 @@ var MarketplaceService = class {
       );
     }
     const shouldEncrypt = isEncrypted(requestEvent);
-    const resultContent = shouldEncrypt ? nip44Encrypt(content, identity.secretKey, requestEvent.pubkey) : content;
+    const payload = hasAttachment ? encodeJobPayload({ text: content || void 0, attachment }) : content;
+    if (shouldEncrypt) {
+      const payloadBytes = utf8ByteLength(payload);
+      if (payloadBytes > LIMITS.NIP44_MAX_PLAINTEXT_BYTES) {
+        throw new Error(
+          `Encrypted job result too large: ${payloadBytes} bytes (max ${LIMITS.NIP44_MAX_PLAINTEXT_BYTES}). Deliver large results as a file/iroh attachment instead.`
+        );
+      }
+    }
+    const resultContent = shouldEncrypt ? nip44Encrypt(payload, identity.secretKey, requestEvent.pubkey) : payload;
     const resultKind = KIND_JOB_RESULT_BASE + offset;
     const tags = [
       ["e", requestEvent.id],
@@ -2128,11 +2261,11 @@ var MarketplaceService = class {
    * With maxAttempts=3: try, ~1s, try, ~2s, try, throw.
    * Jitter: 0.5x-1.0x of calculated delay.
    */
-  async submitJobResultWithRetry(identity, requestEvent, content, amount, maxAttempts = DEFAULTS.RESULT_RETRY_COUNT, baseDelayMs = DEFAULTS.RESULT_RETRY_BASE_MS) {
+  async submitJobResultWithRetry(identity, requestEvent, content, amount, maxAttempts = DEFAULTS.RESULT_RETRY_COUNT, baseDelayMs = DEFAULTS.RESULT_RETRY_BASE_MS, attachment) {
     const attempts = Math.max(1, maxAttempts);
     for (let attempt = 0; attempt < attempts; attempt++) {
       try {
-        return await this.submitJobResult(identity, requestEvent, content, amount);
+        return await this.submitJobResult(identity, requestEvent, content, amount, attachment);
       } catch (e) {
         if (attempt >= attempts - 1) {
           throw e;
@@ -3404,35 +3537,43 @@ function formatNetworkBaseline(estimate) {
   return `Estimated network gas: ${total} SOL (${parts.join(" + ")}).`;
 }
 var NEGATIVE_CACHE_TTL_MS = 6e4;
+var MAX_CACHE_ENTRIES = 5e3;
 var verifyCache = /* @__PURE__ */ new Map();
 function clearQuickVerifyCache() {
   verifyCache.clear();
 }
 async function verifyJobPaymentQuick(rpc, txSignature, expectedRecipient) {
   if (!txSignature) {
-    return { verified: false, txSignature: "", reason: "invalid_input" };
+    return { receivedFunds: false, txSignature: "", reason: "invalid_input" };
   }
   if (!expectedRecipient || !isAddress(expectedRecipient)) {
-    return { verified: false, txSignature, reason: "invalid_input" };
+    return { receivedFunds: false, txSignature, reason: "invalid_input" };
   }
   const cacheKey2 = `${txSignature}:${expectedRecipient}`;
   const cached = verifyCache.get(cacheKey2);
   if (cached) {
-    if (cached.result.verified) {
+    if (cached.result.receivedFunds) {
       return cached.result;
     }
     if (Date.now() - cached.cachedAt < NEGATIVE_CACHE_TTL_MS) {
       return cached.result;
     }
+    verifyCache.delete(cacheKey2);
   }
   const result = await doVerifyOnce(rpc, txSignature, expectedRecipient);
+  if (verifyCache.size >= MAX_CACHE_ENTRIES) {
+    const oldest = verifyCache.keys().next().value;
+    if (oldest !== void 0) {
+      verifyCache.delete(oldest);
+    }
+  }
   verifyCache.set(cacheKey2, { result, cachedAt: Date.now() });
   return result;
 }
 async function doVerifyOnce(rpc, txSignature, expectedRecipient) {
   const sigStr = txSignature;
   if (!rpc || typeof rpc.getTransaction !== "function") {
-    return { verified: false, txSignature: sigStr, reason: "rpc_error" };
+    return { receivedFunds: false, txSignature: sigStr, reason: "rpc_error" };
   }
   let tx;
   try {
@@ -3442,13 +3583,13 @@ async function doVerifyOnce(rpc, txSignature, expectedRecipient) {
       maxSupportedTransactionVersion: 0
     }).send();
   } catch {
-    return { verified: false, txSignature: sigStr, reason: "rpc_error" };
+    return { receivedFunds: false, txSignature: sigStr, reason: "rpc_error" };
   }
   if (!tx) {
-    return { verified: false, txSignature: sigStr, reason: "not_found" };
+    return { receivedFunds: false, txSignature: sigStr, reason: "not_found" };
   }
   if (!tx.meta || tx.meta.err) {
-    return { verified: false, txSignature: sigStr, reason: "tx_failed" };
+    return { receivedFunds: false, txSignature: sigStr, reason: "tx_failed" };
   }
   const accountKeys = tx.transaction.message.accountKeys;
   const recipientStr = expectedRecipient;
@@ -3462,7 +3603,7 @@ async function doVerifyOnce(rpc, txSignature, expectedRecipient) {
       if (pre !== void 0 && post !== void 0) {
         const delta = BigInt(post) - BigInt(pre);
         if (delta > 0n) {
-          return { verified: true, txSignature: sigStr };
+          return { receivedFunds: true, txSignature: sigStr };
         }
       }
     }
@@ -3480,11 +3621,11 @@ async function doVerifyOnce(rpc, txSignature, expectedRecipient) {
       const preAmount = pre ? BigInt(pre.uiTokenAmount.amount) : 0n;
       const postAmount = BigInt(post.uiTokenAmount.amount);
       if (postAmount > preAmount) {
-        return { verified: true, txSignature: sigStr };
+        return { receivedFunds: true, txSignature: sigStr };
       }
     }
   }
-  return { verified: false, txSignature: sigStr, reason: "recipient_mismatch" };
+  return { receivedFunds: false, txSignature: sigStr, reason: "recipient_mismatch" };
 }
 var DEFAULT_LIMIT = 1e3;
 var NATIVE_KEY = "native";
@@ -3579,7 +3720,12 @@ var SessionSpendLimitEntrySchema = z.object({
   chain: z.enum(["solana"]),
   token: z.string().min(1).max(16).regex(/^[a-z0-9]+$/, "token must be lowercase alphanumeric"),
   mint: z.string().min(1).max(64).optional(),
-  amount: z.number().positive().finite()
+  // Stored as a string to preserve the operator's exact decimal text (avoids
+  // Number round-tripping to scientific notation). Legacy configs persisted a
+  // number; accept both and normalize to a positive-decimal string.
+  amount: z.union([z.string(), z.number()]).transform((value) => typeof value === "number" ? String(value) : value.trim()).refine((value) => /^\d+(?:\.\d+)?$/.test(value) && /[1-9]/.test(value), {
+    message: 'amount must be a positive decimal (e.g. "0.5", "1")'
+  })
 }).strict();
 var GlobalConfigSchema = z.object({
   session_spend_limits: z.array(SessionSpendLimitEntrySchema).max(16).optional()
@@ -3779,6 +3925,6 @@ function makeCensor() {
   };
 }
 
-export { BoundedSet, DEFAULTS, DEFAULT_KIND_OFFSET, DEFAULT_REDACT_PATHS, DiscoveryService, ELISYM_PROTOCOL_TAG, ElisymClient, ElisymIdentity, GlobalConfigSchema, INPUT_REDACT_PATHS, JobWaitTimeoutError, KIND_APP_HANDLER, KIND_JOB_FEEDBACK, KIND_JOB_REQUEST, KIND_JOB_REQUEST_BASE, KIND_JOB_RESULT, KIND_JOB_RESULT_BASE, KIND_LONG_FORM_ARTICLE, KIND_PING, KIND_PONG, KNOWN_ASSETS, LAMPORTS_PER_SOL, LIMITS, MarketplaceService, MediaService, NATIVE_SOL, NostrPool, POLICY_D_TAG_PREFIX, POLICY_TYPE_REGEX, POLICY_T_TAG, PROTOCOL_PROGRAM_ID_DEVNET, PaymentRequestSchema, PingService, PoliciesService, RELAYS, SECRET_REDACT_PATHS, SessionSpendLimitEntrySchema, SolanaPaymentStrategy, USDC_SOLANA_DEVNET, aggregateNetworkStats, assertExpiry, assertLamports, assetByKey, assetKey, buildPaymentInstructions, calculateProtocolFee, classifyJobError, clearPriorityFeeCache, clearProtocolConfigCache, clearQuickVerifyCache, compareAgentsByRank, computeRankKey, createPaymentRequestWithOnchainConfig, createSlidingWindowLimiter, estimateNetworkBaseline, estimatePriorityFeeMicroLamports, estimateSolFeeLamports, formatAssetAmount, formatFeeBreakdown, formatNetworkBaseline, formatSol, getNetworkStats, getProtocolConfig, getProtocolProgramId, jobRequestKind, jobResultKind, makeCensor, nip44Decrypt, nip44Encrypt, parseAssetAmount, parsePaymentRequest, pickPercentileFee, resolveAssetFromPaymentRequest, resolveKnownAsset, timeAgo, toDTag, truncateKey, validateAgentName, validateExpiry, verifyJobPaymentQuick };
+export { BoundedSet, DEFAULTS, DEFAULT_KIND_OFFSET, DEFAULT_REDACT_PATHS, DiscoveryService, ELISYM_PROTOCOL_TAG, ENVELOPE_VERSION, ElisymClient, ElisymIdentity, GlobalConfigSchema, INPUT_REDACT_PATHS, JobWaitTimeoutError, KIND_APP_HANDLER, KIND_JOB_FEEDBACK, KIND_JOB_REQUEST, KIND_JOB_REQUEST_BASE, KIND_JOB_RESULT, KIND_JOB_RESULT_BASE, KIND_LONG_FORM_ARTICLE, KIND_PING, KIND_PONG, KNOWN_ASSETS, LAMPORTS_PER_SOL, LIMITS, MarketplaceService, MediaService, NATIVE_SOL, NostrPool, POLICY_D_TAG_PREFIX, POLICY_TYPE_REGEX, POLICY_T_TAG, PROTOCOL_PROGRAM_ID_DEVNET, PaymentRequestSchema, PingService, PoliciesService, RELAYS, SECRET_REDACT_PATHS, SessionSpendLimitEntrySchema, SolanaPaymentStrategy, USDC_SOLANA_DEVNET, aggregateNetworkStats, assertExpiry, assertLamports, assetByKey, assetKey, buildPaymentInstructions, calculateProtocolFee, classifyJobError, clearPriorityFeeCache, clearProtocolConfigCache, clearQuickVerifyCache, compareAgentsByRank, computeRankKey, createPaymentRequestWithOnchainConfig, createSlidingWindowLimiter, decodeJobPayload, encodeJobPayload, estimateNetworkBaseline, estimatePriorityFeeMicroLamports, estimateSolFeeLamports, formatAssetAmount, formatFeeBreakdown, formatNetworkBaseline, formatSol, getNetworkStats, getProtocolConfig, getProtocolProgramId, jobRequestKind, jobResultKind, makeCensor, nip44Decrypt, nip44Encrypt, parseAssetAmount, parsePaymentRequest, pickPercentileFee, resolveAssetFromPaymentRequest, resolveKnownAsset, timeAgo, toDTag, truncateKey, utf8ByteLength, validateAgentName, validateExpiry, verifyJobPaymentQuick };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map